Adding spotbugs to ANALYZER_ORDER so that deduplication will prefer
spotbugs over semgrep in the case that there are duplicate findings in a
pipeline.

Changelog: changed